Latest Cybersecurity News and Articles

---

New Zero-Day Vulnerabilities Could Instantly Drain Crypto Wallets

Multiple zero-day vulnerabilities have been discovered in some of the most used cryptographic multi-party computation (MPC) protocols, putting consumers’ cryptocurrency funds at risk of theft.

---

Google to fight hackers with weekly Chrome security updates

Google has changed the Google Chrome security updates schedule from bi-weekly to weekly to address the growing patch gap problem that allows threat actors extra time to exploit published n-day and zero-day flaws.

---

Newly Discovered Inception Attack Exposes Data from AMD Zen CPUs

A recent disclosure highlights a fresh wave of vulnerabilities, with a major focus on AMD's 'Inception.' This vulnerability enables data leakage through a novel attack approach. Any system with an affected CPU can potentially be the target of the attack. AMD has released microcode in “Zen 3” and “Zen 4” CPU architectures to fully mitigate the attack.

---

Balada Injector Still at Large – New Domains Discovered

The Balada Injector malware continues to evade security software by using new domain names and obfuscation techniques, posing a persistent threat to vulnerable WordPress websites.

---

Cybercriminals Increasingly Using EvilProxy Phishing Kit to Target Executives

Threat actors are increasingly using a phishing-as-a-service (PhaaS) toolkit dubbed EvilProxy to pull off account takeover attacks aimed at high-ranking executives at prominent companies. According to Proofpoint, an ongoing hybrid campaign has leveraged the service to target thousands of Microsoft 365 user accounts, sending approximately 120,000 phishing emails to hundreds of organizations

---

Report: Threat Actors Abuse Valid Accounts Using Manual Tactics

Threat actors are spurning the rise of automation and using manual tactics to intrude organizations’ networks and rapidly access sensitive data, according to CrowdStrike’s 2023 Threat Hunting Report released Tuesday.

---

Open Source Tool Used to Target Ukrainian Government Agencies

Ukrainian government agencies were targeted by hackers in a phishing campaign that utilized the open-source program MerlinAgent. The campaign was conducted by UAC-0154 and involved sending malicious emails to the targets. As attackers adapt their techniques, vigilance becomes paramount.

---

Israeli Hospital Redirects New Patients Following Ransomware Attack

An Israeli hospital near the city of Tel Aviv was hacked on Tuesday by a group of unknown cybercriminals, prompting it to stop admitting new patients and redirecting people to nearby hospitals.

---

Northern Ireland police chief urged to consider position over data breach

DUP MP Sammy Wilson says serious questions must be asked at highest level of PSNI amid fears over safety of officersThe head of policing in Northern Ireland has been urged to consider his position over the mass breach of officers’ data amid warnings that terrorists could use the information to carry out attacks.Sammy Wilson, a Democratic Unionist party MP, suggested Simon Byrne’s future as chief constable might not be sustainable. Continue reading...

---

High-Severity Access Control Vulnerability Found in Spring WebFlux

An advisory on the vulnerability published by JFrog shed light on the exact nature of the flaw, its potential victims, and a proof-of-concept (POC) illustrating the scenarios in which this flaw could be triggered for unauthorized access.

---

AWS Pledges $20M to K-12 Cyber Training, Incident Response

The company is participating in a larger collaboration between government agencies and private sector partners to help target rich, resource-poor organizations like local schools combat malicious attacks.

---

Malicious Campaigns Exploit Weak Kubernetes Clusters for Crypto Mining

In total, Kubernetes clusters belonging to more than 350 organizations, open-source projects, and individuals were discovered, 60% of which were the target of an active crypto-mining campaign.

---

New Report Exposes Vice Society's Collaboration with Rhysida Ransomware

Tactical similarities have been unearthed between the double extortion ransomware group known as Rhysida and Vice Society, including in their targeting of education and healthcare sectors.

---

Interpol Busts Phishing-as-a-Service Platform '16Shop,' Leading to 3 Arrests

Interpol has announced the takedown of a phishing-as-a-service (PhaaS) platform called 16Shop, in addition to the arrests of three individuals in Indonesia and Japan. 16Shop specialized in the sales of phishing kits that other cybercriminals can purchase to mount phishing attacks on a large scale, ultimately facilitating the theft of credentials and payment details from users of popular services

---

OpenBullet Campaign: Cybercriminals Target Script Kiddies

Experienced cybercriminals are taking on script kiddies in a new malware campaign through malicious OpenBullet configuration files. Malicious configurations are shared on platforms like Telegram to deliver a Rust-based dropper and a Python-based RAT named Patent. Adversaries have made a profit in crypto worth $1,703.15 over the past two months.

---

Building digital trust in an organization

The importance of digital trust.

---

Horizon3 AI Raises $40 Million to Expand Automated Pentesting Platform

The additional funding will help the San Francisco-based company integrate pentesting, SOAR, and detection engineering into its platform and expand its channel and partner presence to fuel global growth.

---

PSNI apologies to police officers after unprecedented data breach – video

The UK Information Commissioner’s Office has launched an investigation into an unprecedented data breach that disclosed details of more than 10,000 police officers and staff in Northern Ireland. The agency, which regulates data privacy laws, is working with the Police Service of Northern Ireland to establish the level of risk amid warnings that the leak may compel officers to leave the force or move their home address. The PSNI blamed human error for releasing an Excel spreadsheet that was published on an FoI website and removed two hours later once police discovered the mistake. Chris Todd, a PSNI assistant chief constable, apologised and said the error was unacceptableICO to investigate risk to police officers after Northern Ireland data breach Continue reading...

---

Hacked UK voter data could be used to target disinformation, warn experts

Data from Electoral Commission breach could allow rogue actors to create AI-generated messages in effort to manipulate electionsData accessed in the Electoral Commission hack could help state-backed actors target voters with AI-generated disinformation, experts have warned.The UK elections watchdog revealed on Tuesday that a hostile cyber-attack had been able to access the names and addresses of all voters registered between 2014 and 2022. Continue reading...

---

Data Exfiltration is Now the Go-to Cyber Extortion Strategy

The abuse of zero-day and one-day vulnerabilities in the past six months led to a 143% increase in victims when comparing Q1 2022 with Q1 2023, according to a report by Akamai.